SFS 8 / SF 6

Back to SFS 8

Status: Question model review passed; solution and completed SF authoring pending.

This is a generated authoring draft. Human approval and operational assessment results have not been supplied.

Question

Are all security risk treatment decisions formally documented and maintained throughout the software development lifecycle during the review period?

Plain-language explanation

Model-reviewed question draft. Completed explanations and a canonical solution are pending. The proposed positive criterion is: Documented evidence exists showing all identified security risks were assigned treatment decisions (accept, mitigate, transfer, avoid) with rationale and owner

Assessment criterion and evidence

Actor: Organization. Scope: Software development lifecycle covering all new and modified systems. Evidence period: Review period. Required evidence: Risk register showing treatment decisions for all identified security risks. Negative criterion: No records demonstrating systematic risk treatment decision-making processes. Missing evidence: Pending verification when documentation cannot be located despite system search

View the JSON record (opens in a new tab).

Assessment result: unset.